TSP Accelerator – API record access undercounted for paginated queries

Hello Salesforce Labs Team, 

We identified an issue with the TSP Accelerator package that causes API record access counts to be understated when Salesforce queries return multiple batches.

Our investigation confirmed the following:

• Salesforce Inspector exported 5,000 records through an initial Query request and two QueryMore requests (2,000 + 2,000 + 1,000).
• Historical ApiEvent records show RowsProcessed = 5000 on the initial query, while Records.totalSize = 2000.
• Transaction Security evaluates the initial Query request but not subsequent QueryMore requests. Please see this article that mentions this behavior.
• The TrxSec_DetectTotalAccessAPI class uses LogMultipleRecordAccess.extractRecordCount(e.Records) for threshold evaluation and passes e.Records to the asynchronous logging process. Consequently, only 2,000 records are counted.

for both threshold evaluation and record-access logging, with appropriate fallback handling when the value is unavailable or negative. 

Could you, please, let me know whether this is the appropriate way to log this issue and request this update? We are on v1.7.2.

Thank you in advance!